CVE-2026-63647 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
Unauthenticated attackers can hijack Server-Sent Events streams to read, inject, or terminate other users' notifications in CordysCRM.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63647?
CVE-2026-63647 is a critical missing authorization vulnerability in 1Panel-dev CordysCRM, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilters permits the SSE paths, and the endpoints trust the caller-controlled userId instead of deriving an identity from an authenticated principal. An unauthenticated caller can use /sse/subscribe to read another user's workflow events, approval requests, mentions, and alerts, use /sse/broadcast to inject SYSTEM_HEARTBEAT messages into another user's stream, or use /sse/close to terminate another user's channel. This vulnerability is fixed in 1.7.2.
Which versions are affected by CVE-2026-63647?
How do I fix CVE-2026-63647?
No fix has been published for CVE-2026-63647 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-63647 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63647 exists.
Sources
Also known as GHSA-9qg8-cm35-xqp4.